🇩🇪
IP Analyzer
2026-11-06 08:00:09
UTC ·
(50 minutes ago)
Unauthorized connection attempt from IP address 35.206.147.18 on Port 443
Port Scan
🇳🇱
erwindecker
2026-11-06 07:54:04
UTC ·
(56 minutes ago)
[06/Nov/2026:08:54:02 +0100] 400 - GET http 195.240.146.102 "/" [Client 35.206.147.18] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-"
[06/Nov/2026:08:54:02 +0100] 400 - OPTIONS http 195.240.146.102 "/" [Client 35.206.147.18] [Length 252] [Gzip ...
show more
[06/Nov/2026:08:54:02 +0100] 400 - GET http 195.240.146.102 "/" [Client 35.206.147.18] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-"
[06/Nov/2026:08:54:02 +0100] 400 - OPTIONS http 195.240.146.102 "/" [Client 35.206.147.18] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-"
[06/Nov/2026:08:54:02 +0100] 400 - OJNK http 195.240.146.102 "/" [Client 35.206.147.18] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-"
[06/Nov/2026:08:54:02 +0100] 400 - GET http 195.240.146.102 "/favicon.ico" [Client 35.206.147.18] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-"
[06/Nov/2026:08:54:02 +0100] 400 - GET http 195.240.146.102 "/" [Client 35.206.147.18] [Length 252] [Gzip -] "Mozilla/5.0 (compatible)" "-"
...
show less
Port Scan
Bad Web Bot
Web App Attack
🇮🇩
leomardsy_
2026-11-06 07:45:55
UTC ·
(1 hour ago)
Port Scan
🇨🇦
lakered
2026-11-06 07:38:27
UTC ·
(1 hour ago)
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.97), OS-S ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.97), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:63769m)
show less
Port Scan
Exploited Host
🇩🇪
stefanbe
2026-11-06 07:05:00
UTC ·
(1 hour ago)
HTTPS probing without valid host name (fail2ban)
Port Scan
Web App Attack
🇳🇱
oblivion394
2026-11-06 06:28:36
UTC ·
(2 hours ago)
Suspicious HTTP activity detected
Bad Web Bot
Web App Attack
🇱🇹
Selckie
2026-11-06 06:21:48
UTC ·
(2 hours ago)
fail2ban: NGINX unusual impact
Web App Attack
🇩🇪
Yoisho!
2026-11-06 05:47:54
UTC ·
(3 hours ago)
Web attack from 35.206.147.18
Web App Attack
🇫🇷
Kejult
2026-11-06 05:26:58
UTC ·
(3 hours ago)
Honeypot Finding: repeated TCP service probing on TCP/443 (HTTPS); 7 application-level events across 7 source port(s). Sensor(s): H0neytr4p.
Port Scan
🇩🇪
psauxit
2026-11-06 04:40:32
UTC ·
(4 hours ago)
Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning, commonly xmlrpc_attack, wp-login brute force, excessive crawling/scraping
Web App Attack
Hacking
🇦🇹
vikal
2026-11-06 03:49:55
UTC ·
(5 hours ago)
35.206.147.18 - - [06/Nov/2026:04:49:35 +0100] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-"
35.206. ...
show more
35.206.147.18 - - [06/Nov/2026:04:49:35 +0100] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-"
35.206.147.18 - - [06/Nov/2026:04:49:44 +0100] "0:\x02\x040\xFF\xB5&`2\x02\x01\x03\x04\x17cn=hxrukkqtrerbsvedqjtz\x80\x14hxrukkqtrerbsvedqjtz" 400 150 "-" "-"
35.206.147.18 - - [06/Nov/2026:04:49:54 +0100] "\x00\x00\x00C\x00\x12\x00\x00\x1E3\xF4\x81\x00\x1Fconsumer-Offset Explorer 2.2-18\x00\x12apache-kafka-java\x062.4.0\x00" 400 150 "-" "-"
35.206.147.18 - - [06/Nov/2026:04:49:54 +0100] "\x00\x00\x00#\x00\x03\x00\x00\x1E3\xF4\x81\x00" 400 150 "-" "-"
35.206.147.18 - - [06/Nov/2026:04:49:54 +0100] "*1" 400 150 "-" "-"
...
show less
Brute-Force
SSH
🇨🇳
WMK965
2026-11-06 03:29:06
UTC ·
(5 hours ago)
Malicious requests
IP: 35.206.147.18
Time: 06/Nov/2026:11:28:41 +0800
User-Agent: -
Activities:
"07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0 ...
show more
Malicious requests
IP: 35.206.147.18
Time: 06/Nov/2026:11:28:41 +0800
User-Agent: -
Activities:
"07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 154 "-"
"0:\x02\x04!%\xAD\xF0`2\x02\x01\x03\x04\x17cn=lweiandoqrwswzbzzyki\x80\x14lweiandoqrwswzbzzyki" 400 154 "-"
"\x00\x00\x00C\x00\x12\x00\x00\x1E3\xF4\x81\x00\x1Fconsumer-Offset Explorer 2.2-18\x00\x12apache-kafka-java\x062.4.0\x00" 400 154 "-"
show less
Port Scan
Web App Attack
🇺🇸
solantex
2026-11-06 03:15:54
UTC ·
(5 hours ago)
Malformed and abusive traffic directed at Solantex services.
Port Scan
🇸🇰
Schomburg
2026-11-06 02:52:03
UTC ·
(5 hours ago)
Automatic report from SCH firewall log.
https://github.com/Ragnarocek/Windows_FW_AbuseIPDB_Reporting ID: J7X61jnFVBgx9gkF3gZB3jLLVjMUcOXd
Port Scan
Hacking
Brute-Force
🇦🇺
LiftUp Hosting
2026-11-05 15:26:06
UTC ·
(17 hours ago)
Honeypot hit: Unauthorized traffic (4 bytes of payload); 8808 [3] TCP
Port Scan